rpc.nfsd Host Option & IPv6

rpc.nfsd Host Option & IPv6

[Sean Elble]

Hi all,

While it seems that most folks use iptables to restrict access to single 
interfaces when multihomed hosts are acting as NFS servers, I do see 
that there is a "--host" option that can be provided to rpc.nfsd when it 
starts so that it only binds to a specific IP/interface.

This does seem to work nicely, but when I try to use it, it throws an 
error/warning (where nfs-server is defined in /etc/hosts for the IPv4 
address of the interface I wish for TCP port 2049 to be opened on):

rpc.nfsd: unable to resolve nfs-server:nfs to inet6 address: Name or 
service not known

Commenting out the following lines in /etc/netconfig (as suggested by 
the Google) allows the daemon to start without error:

udp6       tpi_clts      v     inet6    udp     -       -
tcp6       tpi_cots_ord  v     inet6    tcp     -       -

But I'm wondering if that is the only means for this to work, 
particularly considering that I'd expect changes to /etc/netconfig to 
apply to more than just rpc.nfsd.

It is worth noting that 1) this seems to apply equally to Debian-based 
and RHEL-based systems and 2) things seem to work even with the error, 
but I wouldn't have expected to see that message for something 
(seemingly) so simple.

Any and all thoughts are welcome.

Thanks,

Sean

Re: rpc.nfsd Host Option & IPv6

[Kinglong Mee]

Cc steve,

On 6/3/2015 9:39 PM, Sean Elble wrote:
> Hi all,
> 
> While it seems that most folks use iptables to restrict access to single interfaces when multihomed hosts are acting as NFS servers, I do see that there is a "--host" option that can be provided to rpc.nfsd when it starts so that it only binds to a specific IP/interface.
> 
> This does seem to work nicely, but when I try to use it, it throws an error/warning (where nfs-server is defined in /etc/hosts for the IPv4 address of the interface I wish for TCP port 2049 to be opened on):
> 
> rpc.nfsd: unable to resolve nfs-server:nfs to inet6 address: Name or service not known

It is caused by that rpc.nfsd try to bind IPv4 and IPv6 address default.
you don't support an IPv6 address, so rpc.nfsd print the message.

But, IPv4 is work correctly.

> 
> Commenting out the following lines in /etc/netconfig (as suggested by the Google) allows the daemon to start without error:
> 
> udp6       tpi_clts      v     inet6    udp     -       -
> tcp6       tpi_cots_ord  v     inet6    tcp     -       -

If you comment those lines, rpc.nfsd will check /etc/netconfig and find udp6/tcp6 is not allowed,
so, rpc.nfsd will not bind IPv6 address, the message is not printed.

> 
> But I'm wondering if that is the only means for this to work, particularly considering that I'd expect changes to /etc/netconfig to apply to more than just rpc.nfsd.

Agree with you.

> 
> It is worth noting that 1) this seems to apply equally to Debian-based and RHEL-based systems and 2) things seem to work even with the error, but I wouldn't have expected to see that message for something (seemingly) so simple.

I think we should not print the message as you want.

thanks,
Kinglong Mee

Re: rpc.nfsd Host Option & IPv6

[Kinglong Mee]

On 6/7/2015 5:06 PM, Kinglong Mee wrote:
> Cc steve,
> 
> On 6/3/2015 9:39 PM, Sean Elble wrote:
>> Hi all,
>>
>> While it seems that most folks use iptables to restrict access to single interfaces when multihomed hosts are acting as NFS servers, I do see that there is a "--host" option that can be provided to rpc.nfsd when it starts so that it only binds to a specific IP/interface.
>>
>> This does seem to work nicely, but when I try to use it, it throws an error/warning (where nfs-server is defined in /etc/hosts for the IPv4 address of the interface I wish for TCP port 2049 to be opened on):
>>
>> rpc.nfsd: unable to resolve nfs-server:nfs to inet6 address: Name or service not known
> 
> It is caused by that rpc.nfsd try to bind IPv4 and IPv6 address default.
> you don't support an IPv6 address, so rpc.nfsd print the message.
> 
> But, IPv4 is work correctly.
> 
>>
>> Commenting out the following lines in /etc/netconfig (as suggested by the Google) allows the daemon to start without error:
>>
>> udp6       tpi_clts      v     inet6    udp     -       -
>> tcp6       tpi_cots_ord  v     inet6    tcp     -       -
> 
> If you comment those lines, rpc.nfsd will check /etc/netconfig and find udp6/tcp6 is not allowed,

Sorry, udp6/tcp6 should be inet6 here.

thanks,
Kinglong Mee

> so, rpc.nfsd will not bind IPv6 address, the message is not printed.
> 
>>
>> But I'm wondering if that is the only means for this to work, particularly considering that I'd expect changes to /etc/netconfig to apply to more than just rpc.nfsd.
> 
> Agree with you.
> 
>>
>> It is worth noting that 1) this seems to apply equally to Debian-based and RHEL-based systems and 2) things seem to work even with the error, but I wouldn't have expected to see that message for something (seemingly) so simple.
> 
> I think we should not print the message as you want.
> 
> thanks,
> Kinglong Mee
> 

Re: rpc.nfsd Host Option & IPv6

[Chuck Lever]

On Jun 3, 2015, at 9:39 AM, Sean Elble <elbles@sessys.com> wrote:

> Hi all,
> 
> While it seems that most folks use iptables to restrict access to single interfaces when multihomed hosts are acting as NFS servers, I do see that there is a "--host" option that can be provided to rpc.nfsd when it starts so that it only binds to a specific IP/interface.
> 
> This does seem to work nicely, but when I try to use it, it throws an error/warning (where nfs-server is defined in /etc/hosts for the IPv4 address of the interface I wish for TCP port 2049 to be opened on):
> 
> rpc.nfsd: unable to resolve nfs-server:nfs to inet6 address: Name or service not known

This is a DNS error. No IPv6 mapping is provided in /etc/hosts. I suppose
if you provided “-H ipv4-address” the getaddrinfo(AF_INET6) call would
also fail.

Normally an ANY address is used when setting up NFSD listeners, and
no DNS lookup is done. This appears to be an issue just with -H.

> Commenting out the following lines in /etc/netconfig (as suggested by the Google) allows the daemon to start without error:
> 
> udp6       tpi_clts      v     inet6    udp     -       -
> tcp6       tpi_cots_ord  v     inet6    tcp     -       -
> 
> But I'm wondering if that is the only means for this to work, particularly considering that I'd expect changes to /etc/netconfig to apply to more than just rpc.nfsd.

The kernel handles IPv4 and IPv6 traffic on separate listener sockets.

It appears that with support for /etc/netconfig, it is possible to
set up a UDP AF_INET NFSD socket and a TCP AF_INET6 NFSD socket?

Since these are not really TI-RPC sockets and libtirpc isn’t
involved after the sockets are passed to the kernel, I’m not sure
it’s appropriate to consult /etc/netconfig here?

Anyway, the creation of the IPv4 socket succeeded, but the creation
of the IPv6 socket did not. At least one socket was created, so the
rpc.nfsd command worked, even though it threw a spurious error.

My preference would be to change the way all this works so that a
single getaddrinfo(3) could be used for both sockets. That way the
DNS failure would occur only if there were _no_ valid addresses,
since that’s the only legitimate failure in this case.

Jeff, any thoughts? Am I contradicting myself from 6 years ago?

--
Chuck Lever
chuck[dot]lever[at]oracle[dot]com

Re: rpc.nfsd Host Option & IPv6

[Jeff Layton]

On Mon, 8 Jun 2015 15:48:29 -0400
Chuck Lever <chuck.lever@oracle.com> wrote:

> 
> On Jun 3, 2015, at 9:39 AM, Sean Elble <elbles@sessys.com> wrote:
> 
> > Hi all,
> > 
> > While it seems that most folks use iptables to restrict access to single interfaces when multihomed hosts are acting as NFS servers, I do see that there is a "--host" option that can be provided to rpc.nfsd when it starts so that it only binds to a specific IP/interface.
> > 
> > This does seem to work nicely, but when I try to use it, it throws an error/warning (where nfs-server is defined in /etc/hosts for the IPv4 address of the interface I wish for TCP port 2049 to be opened on):
> > 
> > rpc.nfsd: unable to resolve nfs-server:nfs to inet6 address: Name or service not known
> 
> This is a DNS error. No IPv6 mapping is provided in /etc/hosts. I suppose
> if you provided “-H ipv4-address” the getaddrinfo(AF_INET6) call would
> also fail.
> 
> Normally an ANY address is used when setting up NFSD listeners, and
> no DNS lookup is done. This appears to be an issue just with -H.
> 
> > Commenting out the following lines in /etc/netconfig (as suggested by the Google) allows the daemon to start without error:
> > 
> > udp6       tpi_clts      v     inet6    udp     -       -
> > tcp6       tpi_cots_ord  v     inet6    tcp     -       -
> > 
> > But I'm wondering if that is the only means for this to work, particularly considering that I'd expect changes to /etc/netconfig to apply to more than just rpc.nfsd.
> 
> The kernel handles IPv4 and IPv6 traffic on separate listener sockets.
> 
> It appears that with support for /etc/netconfig, it is possible to
> set up a UDP AF_INET NFSD socket and a TCP AF_INET6 NFSD socket?
> 
> Since these are not really TI-RPC sockets and libtirpc isn’t
> involved after the sockets are passed to the kernel, I’m not sure
> it’s appropriate to consult /etc/netconfig here?
> 
> Anyway, the creation of the IPv4 socket succeeded, but the creation
> of the IPv6 socket did not. At least one socket was created, so the
> rpc.nfsd command worked, even though it threw a spurious error.
> 
> My preference would be to change the way all this works so that a
> single getaddrinfo(3) could be used for both sockets. That way the
> DNS failure would occur only if there were _no_ valid addresses,
> since that’s the only legitimate failure in this case.
> 
> Jeff, any thoughts? Am I contradicting myself from 6 years ago?
> 

No, sounds reasonable to me. I suspect that the code is probably not
structured to handle that well at the moment, so that'll mean some
refactoring.

-- 
Jeff Layton <jlayton@poochiereds.net>